FR3089321A1 - Computer attack defense methods and programs - Google Patents

Abstract

Computer attack defense methods and programs. The invention relates to methods of defense against computer attacks and to computer programs comprising code instructions which, when executed on a processor, carry out the steps of the Methods. The invention is characterized by the methods called Method A, Method B and Method C in this patent application and by the computer programs called computer program 1, computer program 2, computer program 3, program d computer 4 and computer program 5 in this patent application. And as described above.

Description

Description

Title of the invention: Methods and programs for Defense against computer attacks The present invention relates to methods and programs for computer defense against computer attacks.

The technical field is: Information Systems Security, the known acronym of which is SSI. Or in other words IT security.

The state of the prior art: in the field of information systems security or in other words computer security, the previous methods (previous concepts, previous logics) of defense against attacks and / or intrusions direct on a network - that is to say the existing procedures to date - against computer attacks, whether for espionage (s), sabotage (s) or locking (s) against request (s) ) of ransom (s), consist in challenging, with a network (s) "frozen (s)", "static (s)" and "passive (s)" an (s) intelligent attacker (s) ( s), active (s), dynamic (s), sometimes acting slowly and sometimes stealthily. And this, by:

- sensors installed on a network (s) and predefined equations and rules analyzing the information reported by the sensors for the detection (interception) of "computer intrusion (s)" and "exploitation (s) ) intrusion (s) ”by detecting computer activity (ies) on a network (s); activity (ies) "deemed" illegitimate by the analysis rules and equations.

- sending alert (s) for neutralization and / or sending alert (s) accompanied by automatic neutralization (blocking).

- computer programs to protect the terminals (computers for example) based on the one hand, on the safeguarding in their memory (S) of the activity known as “normal” and on the other hand, on the detection of abnormal "deemed (s)" activity (ies); and this also by detecting the signature (s) of malicious codes identified a priori and integrated into the program database.

Note: the information system (s) or in other words the computer system (s) are sometimes cited in this patent application by (thanks to) their acronym, namely SL Attacks (threats): note that there are roughly three types of attacks (threats) or in other words three major families of computer attacks (threats):

- The attack which will be called Attack type 1 (Threat 1) in these patent application documents and the steps of which are described in Figure 1 found in accordance with the regulations at the end of these patent application documents. Type 1 attack is an attack that we will call a direct attack on the network (s).

- The attack which will be called Attack type 2 (Threat 2) in these patent application documents is an attack (threat) on the terminals (computers by way of non-exclusive example), ie an attack which targets terminals (computers by way of nonexclusive example) by means of trapped electronic mail, ie carrying (containing) malicious content in their content.

The latter, that is to say the terminals, computers by way of nonexclusive example, are connected to one (or more) network (s) and therefore also constitute one (or more) entry point (s) , access, attachment (s), on (to) one (or more) network (s).

They (the terminals) can also allow an escalation of the network (s) thereafter. An escalation which is also technically sometimes called lateralization of the attack. It also depends on the starting point for (the) attacker, i.e. the level of user rights granted to the terminal user (to terminal users) by the network administrator, that the attacker has successfully infiltrated, infected or otherwise said on which one (s) he has successfully executed malicious code (s).

- The attack which we will call Attack type 3 (or threat 3) is achievable by (thanks to) one (of) physical access (s) to succeed "one (of) connection (s)" on the network. Unique (s) or repetitive (s).

It should be noted that the subject of this patent application relates to defense methods and computer program products against type 1, 2 and 3 attacks (threats).

FIG. 1 represents in section, the diagram (the stages) of attacks type 1 and 3. [0008] The attacker can however not necessarily follow the stages described in the diagram below (in order, or in the order described) and try. Since the attacker can decide to attack (to attempt attacks or in other words exploitations or exploitation on) X targets at the same time and tell himself that he will see where - ie on which (s ) target (s) - its exploitation (its exploitations) will function (will function) without necessarily following a logic optimizing its chances of success on a given target.

So even if ATTACKS D and E described in diagram 1 below are very unlikely to succeed (everyone) is not necessarily logical and / or does not necessarily follow a logic which optimizes the chances of success on a given target. Especially if from the start the strategy consists in "trying" on a large number X of different targets.

So we are forced to distinguish on the basis of what we have just explained and on the basis of the steps described in diagram 1 several types or in other words combinations of possible steps: five (5) to be precise. Here is diagram 1 (note that diagram 1 is read with figure 1 describing steps 1, 2, 3, 4 and 5 of diagram 1 and let us specify that figure 1 is at the end of this patent application in accordance with the regulations):

ATTACK "A" = STEP 1 + STEP 2 + STEP 3 + STEP 4 + STEP 5 [AT12] ATTACK "B" = STEP 2 + STEP 3 + STEP 4 + STEP 5 [AT13] ATTACK "C" = STEP 3 + STEP 4 + STEP 5 [0014] ATTACK "D" = STEP 5 [ATTACK "E" = Exploitation (s) of faults "0 day".

Explanation of 0 day fault: 0 day fault means "a manufacturing fault". That is to say a flaw during the coding at the manufacturer (s) of the program (s) used by the target on one or more given version (s). The manufacturer (s) manage (s) to remedy these flaws generally when they learn their existence (s) following a 0 Day attack relating to their product (s) and pass on the benefit to their customer (s). remedies through updates. But before the correction (s) and the update (s), the target remains vulnerable. And when a zero Day flaw is used for the first time (therefore not recovered on the black web or elsewhere) or sought (found) by peeling a code to attack a specific target, this is fatal.

PS 1: During attack E, the attacker does not "necessarily" use a 0 Day exploitation for programs that he has identified in his target. But sometimes uses known and / or recovered 0 Day exploitations on what is called the black web (an anonymous exchange platform used by hackers) hoping that the program (s) for which (which) it has flaw (s) 0 Day exists (s) in its target. The programs are often widespread, the manufacturers of computer programs not being very numerous. A flaw for Microsoft programs for example.

PS 2: during attack D, the attacker does not use exploitations for vulnerabilities collected on the target network (s) after interrogating the network (s) of the target since it skips step 3 of figure 1. It uses a known exploitation (s) and / or recovered (s) on the "black web" known under the name of "dark web ”in English, or elsewhere through various means, hoping that the vulnerability (s) exists (s) in its target (s).

The stages of type 2 attacks are:

- step 1: send one (or more) electronic mail (s) (also known as email or singular email) said trapped (s) to the electronic address (es) of a user (of users) d '' a terminal (of terminals) connected to a given network (s). Trapped e-mail (s) i.e. e-mail (s) containing an infection or otherwise saying a virus or otherwise saying a Trojan horse or otherwise saying Malware or otherwise saying a code (s) ( s) malicious executable (s) on a terminal (terminals) - computers by way of non-exclusive example -; and allowing an action (s) on the terminal (terminals) on which (which) will be (will) be opened, - executed (s) - the malicious code (s) by opening of attachment (s) to e-mail (s) and / or by clicking (i.e. action consisting in clicking) on the hypertext link (s) in the content (s) of the ) email (s).

- step 2: Retrieve the information available on the terminal (terminals), sabotage it (s) or lock it (s) against ransom demand (s). And / or escalate the network from this terminal (these terminals) since it is (are) connected to the network (s). The depth (magnitude) of the threat and / or attack will depend on the starting point. That is to say the terminal (s) reached by the malicious code (s) and the rights granted on the network (by the legal administrator of the network) to the user whose attacker obtained remote access to his terminal. Or interrogate the network from this terminal. Or retrieve information available on the terminal.

Recall that the attack called Attack 2 (Threat 2) in this patent application is an attack (threat) on the terminals (computers by way of non-exclusive example), that is to say which targets the terminals.

Also remember that the latter, that is to say the terminals, are connected to one (of) network (s) and therefore also constitute one (s) point (s) of entry (s), of access , on the network (s) to which they (the terminals) are connected / installed. They (the terminals) can also allow an escalation of the network (s) thereafter. An escalation that is also sometimes called technically: lateralization of the attack. Also remember that it depends on the starting point for (the) attacker, i.e. the level of user rights granted to the terminal user (to terminal users) by the administrator of the network, that the attacker has successfully infiltrated, infected or otherwise said on which one (s) he has successfully executed malicious code (s).

Before describing the technical solutions and previous (existing) processes, let us note, first of all, that the existing technical solutions are effective. And that the object of this patent application is in no way to criticize and / or replace them "but to complete them" with "New", "complementary" Processes (concepts, logic) and Computer Programs but also "additional" and with very high added value (s).

These patent application documents point however to the (the) limits of the existing as well as the loopholes and / or margin (s) of insecurity (s) left by the existing solutions and / or by the (the) mode (s) of management (s) adopted by the users of these solutions, which still allow many hacks and successful computer attacks today; to offer "new", "different", additional, sometimes complementary, computer processes and programs with very high added value (s).

The previous solutions (already existing) are:

- Network Analysis (s) solutions (x).

- Terminal Analysis solutions.

- analysis solutions for the detection of malicious code on terminals on the basis of previous census (es).

- solutions for configuring share rights on a network (s).

Indeed, the Security of Information Systems (SSI) - or in other words - the Security of Computer Systems "against direct type 1 attacks", is based (based) so far on "Network Analysis (s) Solutions" and / or "Terminal Analysis Solutions" for the detection of activity (s) judged abnormal by the predefined rules and equations and for the detection of malicious code on the basis of previous census (es) of what is technically called "signatures". The Security of Computer Systems (information systems) "against direct type 1 attacks" is also based on solutions for configuring share rights on the network.

"Network Analysis Solutions (s)":

- sensors installed on a network (s) to report information relating to the activity of the network (s), namely the logs, with Analysis Tools for the information reported by the sensors ( 'log analyzes). This is for the detection and / or interception of presence (s) and / or activity (ies) "deemed (s)" illegitimate. The analysis (analyzes) is carried out by (on the basis of) predefined analysis rules and equations (computer codes). These tools are called SIEM in the IT security world. These tools are equipped with an automatic alert and / or blocking system (s). The rules and equations (codes) of these tools are subject to updates.

- additional analysis tools which analyze the "history" or "the histories" of the first analysis tools to "verify" that there has not been one or more activity (s) "to be considered illegitimate" which has not been reported in the alerts. These analyzes are also made on the basis of predefined rules and equations (codes). And are also subject to updates.

- "Honey jars" which are generally IP addresses left vacant so that the attacker (attackers - hackers) can use them; and are equipped with sensors to intercept (intercept) them. The attacker (attackers) sometimes seeking to grant themselves an IP address (es) first on the network as a starting point (hook). And / or to interrogate the network from this (these) IP addresses and exploit and / or escalate the network thereafter.

"Terminal Analysis Solutions":

- "Endpoint": that is to say tools which first memorize (save in a memory) the activity (activities) "called (s) normal (s)" of a terminal (a computer as 'nonexclusive example). Then send an alert (s) and / or block the terminal (terminals) if an activity (ies) different from that (s) "recorded as being normal" is (are) detected on the terminal (the terminals); or in other words if an activity (ies) different from that (s) "recorded in the tool memory as being normal" is (are) detected.

"Analysis solutions for the detection of malicious code on terminals on the basis of previous census (es) of what are technically called signatures":

- anti-virus and anti-malware.

The "configuration (granting) of action rights on the network" solutions:

- Firewalls.

The limits of existing solutions:

Let us recall that the existing technical solutions are effective and that the object of this patent application is in no case to replace them "but to supplement them" with Computer Processes and Programs which are initially very "different" and which are "additional" and sometimes "complementary" to the existing one. These patent application documents point however to the limits of the existing (existing technologies) and the loopholes and / or margin (s) of insecurity (s) left by the existing solutions and by the management (s). made by the users of existing solutions, which still allow today a very large number of hacks and successful computer attacks, to propose "new", "different", additional Processes (concepts, logics) and sometimes complementary to the existing and with very high added value (s); as well as Computer Programs comprising code instructions which, when executed on a processor, carry out the steps of the “new”, “different”, additional, complementary to the existing and very large (s) Processes added value (s).

Limit (s) or in other words fault (s) (from the attacker's point of view) of network analysis solutions by sensors and the analysis of information reported by the sensors:

- Recall that the Analysis tools (logs) equipped with sensors described above are very effective but base security on detection, alert and automatic blocking (or manual blocking) on the basis of rules and equations d 'predefined analyzes which are subject to updates. However, this presents two limits or say from the point of view of the attacker, two flaws exploitable by an attacker with regard to network analysis solutions.

The first:

As the network is active during working hours, "automatic detection and blocking" of "what is judged" or "activity on the judged network" or "activities on the judged networks" suspicious (s) and / or illegitimate by the predefined rules and equations of the tool (tools) described in a) are made from "configuration arbitration". Because the activity of "a hacker" or say a person "who illegally enters a network" generates "activities more or less similar" to those of legitimate users. Depending on the caution and cunning of the attacker.

If the analysis tools are set to suspect or "to judge suspect" and block (and / or alert of) all activities on one (or more) network (s) to obtain a risk equal to zero, all activities (logs) on the network (s) will be raised in alerts and the network (s) will be (will) be blocked permanently in the event of setting up option (s) automatic blocking. This is why, the user (users) of these tools must (must) make an arbitration and thus leave (s) a margin of insecurity by which the hacker can operate without being neither blocking nor detecting.

The second:

The network being active during working hours, "detection and alerts without automatic blocking" concerning "what is judged" or say "activity deemed" suspicious and / or illegitimate by the predefined rules and equations of the The tool (tools) described in a) are also made from “an arbitration” or in other words are based “on a configuration arbitration” or in other words “an arbitration in the configuration of the analysis tools (of logs ) "Because, as in the case of automatic detection and blocking, the activity of" a hacker "or, say, a malicious person" who illegally enters the network "generates" more or less less "like" legitimate users. Depending on the caution and cunning of the attacker.

If the analysis tools are set "to suspect or say to judge suspect and alert of all activity on the network; setting allowing to obtain a risk equal to zero ", all the activities (logs) on the network (s) will be raised in alerts.

And in this case "the only and simple visualization and verification of the content of alerts" given their quantities per minute or even per second would require tens or even hundreds of humans "highly qualified in addition" to judge their relevance.

And in this case, the predefined rules and equations for log analysis would be useless, their existence being useful to avoid employing a hundred highly qualified people to analyze humanely the activity of the network (s) and logs.

This is why, whether it is “automatic detection and blocking” or “detection and alerts without automatic blocking”, the user of these tools must make a trade-off between what is called a rate of silence and a noise rate.

A configuration of the tool allowing a very low or almost zero risk systematically increases the noise rate in the alerts and would block the network permanently and / or would require a large number of highly qualified humans to verify the alerts which would contain a lot of noise or otherwise say alerts that would contain false alerts; and this in real time.

A configuration that we will call "reasonable" of the tool allowing automatic blocking and / or raising of "reasonable" and above all "manageable" alerts systematically increases the rate of silence or in other words the risk of silence. That is to say an illegitimate activity (ies) which does not go up in the alerts and which are neither detected nor blocked by the analysis tools.

The (a) so-called "reasonable" configuration of solutions a) on the basis of the elements described above, thus creates a margin of insecurity and therefore leaves one (or more) flaw (s) by which (which) the hacker (s), the attacker or in other words an attacker (s) can (can) operate (i.e. break in, remain present and work illegitimately on a network) without being detected, blocked or generating alerts.

Limit (s) or in other words (from the point of view of the attacker), the flaw (s) of the complementary analysis solutions which analyze "the history" or "the histories" of the first analysis tools by sensors:

- First, the detection in the history is de facto and by definition a "late" detection. Because if the illegitimate activity is recorded only in history, it is that it was not raised in the alerts in time and ΓΙΡ used by its author was not therefore blocked.

In the context of an attack based on rapid exploitation (sabotage or locking against ransom demand) and therefore on stealth, this defense method by subsequent detection in history is not effective.

On the other hand, the rules of analysis (s) in the history (the histories) are based on the detection of activity (s) "deemed" illegitimate (s) by the detection "of a large number ”(or a certain number say) of activity (ies)“ by the grouping of activity (ies) coming from the same IP address for example ”. Or by the grouping of "fractions" in the history which as a whole constitute a threat.

However if the attacker, "lets time pass between his activities" therefore between "the fractions" it is not detected as being illegitimate even after analysis (s) of the history and grouping of fractions in the historical.

Note also that the attacker can also change the IP address and / or "juggle" between several IP addresses to generate activity on the network (s).

To summarize, the idea (the strategy) of an attack (illegitimate activity) "not detected" or let's say "not detectable" simply consists in adopting a behavior generating an activity "exactly similar" to that of a legitimate user who generates an activity in the exercise of his function.

Finally, note that the limit of all existing defense processes (defense logic) based on network analysis resides in the fact that the network is static, frozen and therefore above all "understandable". And that the analysis rules are also understandable and therefore circumventable.

Indeed, when we understand a defense process we always find one (or more) way (s) to get around it.

On the other hand, one (s) attacker (s) - pirate (s) - can (can) take advantage - and usually take advantage (s) when he (s) is not (are not) a novice ( s) - from an occasional moment of absence (leave, etc.) or can (can) provoke - and usually provokes (s) when there is (are) creativity (s) - an absence (s) ) of one or more legitithne user (s) on a network (s) - accident, invitation, appointment, etc. -, to generate an activity (activities) from its terminal (their terminals) and / or its IP address (their IP addresses).

This activity (these activities) - that is to say in the absence of the user (users) Legithne (s) - will not be (will) be judged as being illegitimate (s); suspicious (s) - by the analysis tool (s) because the analysis tool (tools) "which detects (s) duplicates" will not detect "duplicates". Duplicate (s) means two (or more) identical IP addresses generating one (of) activity (s) (operating) on one (s) network (s) from two (or more) different terminals.

Limit (s) or in other words (from the attacker's point of view), the flaws of Endpoint solutions:

First, note that Endpoints only protect terminals that are connected to the network (s) to prevent escalation from a terminal and are not affected by direct attack (s) type 1 and 3.

Furthermore, as regards type 2 attacks, endpoints are certainly effective but do not allow zero risk. An intelligent attacker, in the context of an attack for espionage or even for sabotage or locking against ransom may only work from the terminal during working hours and operate in such a way as to generate an activity deemed very legitimate because it is slow and similar to the activity of the legitimate user in their hands on the terminal.

The attacker can also be satisfied with recovering information on the terminal to avoid being detected (blocked) by the firewall (s) and to have elements making it possible to better prepare (perfect) his attack and subsequently attack another terminal and advance slowly and "letting time pass between its activities". Thus its activity on the terminal (terminals) protected by endpoint and firewall (s) will not be detected as illegitimate. Or when it is, he would have already managed to get information.

Recall that the idea (strategy) of an attack (illegitimate activity) "not detected" is simply to adopt a behavior generating an activity "exactly similar" to that of a legitimate user who generates an activity in the part of the exercise of its function and this "without duplicate (s)".

The limits of anti-virus and anti-malware solutions:

Anti-virus and anti-malware protect devices that are connected to the network (s) only. And to prevent escalation from a terminal but are not affected by the direct security of the network (s) and therefore by direct attacks type 1 and by physical access (s) type 3.

Anti-virus and anti-malware are also effective solutions for protecting terminals. They detect the presence of “viruses”, in other words, “infections” and malicious code based on the basis (s) of what is called “a signature” or signatures, identified by the manufacturers. anti-virus and anti-malware. Each Malware and virus having a signature introduced in the database (s) of Antivirus and Anti-Malware to detect them in the targets to be protected.

However:

- When it is a new infection, anti-viruses and anti-malware do not detect the signature because it is simply not saved in the database (s). Malicious code must be used "at least" once to be identified.

- Between the identification of a "new signature of infection" and the updating, a delay is logically necessary. In addition, the target does not sometimes perform the update (s) immediately as soon as it (s) is (are) available (s) and proposed (s) by the manufacturer of anti virus and anti-malware.

Finally, beyond the solutions described above, or in other words "in addition", the Security of Information Systems or in other words IT security also relies on a complementary logic of recurrent security audits of a network (s) (external and internal intrusion tests as well as vulnerability assessment audits) to identify flaws / vulnerabilities and correct them.

However, on the one hand, the audit logic does not provide security against Type 2 attacks.

And on the other hand, the audit logic which therefore consists in carrying out (recurrently) one (or more) intrusion test (s) and / or vulnerability audits on one (of ) network (s) to identify (collect) the vulnerabilities and flaws present on the network (s) then publish a report (s) with the remedies and / or a remediation roadmap leaves the environment (ie the network) vulnerable to several periods.

Figure 2 shows the stages in time of the first two security audits in the life of a computer network. Knowing that the next will obey the same logic.

Literary explanations of Figure 2:

- Let tO be the first audit in the life of a network. Such as: tO = start date of the audit; tl = end date of the audit; t2 = date of issue of reports; t3 = date of implementation of the fixes by the IT team; t4 = network development date; t5 = date of the next (second) audit; t6 = date of end of the audit; t7 = end date of the edition of the reports of the second audit; t8 = date of implementation of the corrective measures for the second audit reports; t9 = date of a new development.

FIG. 3 shows the flaws in the security audit logic over time, considering by way of example the first two security audits in the life of a computer network. Knowing that the next will obey the same logic and present the same disadvantages.

Additional literary explanations of Figure 3:

- The cyclical logic of the audit imposes "space-time intervals" between what we call in this patent application the events and the different phases of the audit "during which the network is vulnerable".

- A space-time interval between the start of the audit (which we call tO) and its end (which we call tl). Space-time (tO - tl) therefore presents a vulnerable network (environment) favorable to the attacker.

- A space-time interval between the end of the audit (tl) and the date of publication of reports (which we call t2) presenting the vulnerabilities found, the corrective (s) corresponding to each vulnerability and the recommendations to be applied. Space-time (tl -12) therefore presents a vulnerable network (environment) favorable to the attacker.

- A space-time interval between the date of publication of the reports (t2) and the date of implementation of the patches (which we call t3). Space-time (t2 -13) therefore presents a vulnerable network (environment) favorable to the attacker.

- In addition, all activity needs to develop, information systems serving the activity and not the other way around. However, this development (development and implementation of new internal and / or external applications, new network implementations, etc.) will take place at a date that will be called (t4) and will translate from a “security of information systems ”by creating new (at least potential) vulnerabilities and security breaches.

- This (s) development (s) creates (s) a new vulnerable time space (and therefore favorable to the attacker) between the execution date on the network (implementation on the network) of this development (s) (s) and "the date of implementation of the corrective measures for the report (s) of the next audit (s)" which will be called (t8). Knowing (considering) that the start date of the next audit is (t5); the end date of the next audit is (t6) and the date of issue of the report (s) of the next audit is (t7). Then a new development (s) will take place in (t9), etc.

Furthermore, hacking techniques evolve independently of the dates of the audits. The dates are defined by the targets and not by the security companies that track new techniques and developments for three reasons:

- reasons for the availability of IT teams at the targets (excluding periods of IT sites, etc.). IT teams generally prefer, for absurd reasons, to be available.

- budgetary reasons and / or slow procedure (s) of validation of budget (s).

- security companies being remunerated during audits, targets sometimes doubt the good faith of security companies when they talk about the urgency of upgrading the network in the face of new threats.

This demonstrates that SSI security obeying (based on) a cyclical security logic by audit (s) recurring (cyclical) creates an environment (leaves a network) often vulnerable and therefore often favorable to the attacker and therefore often conducive to the success of a computer attack.

And it is these space-time intervals described above during which the network (s) is (are) vulnerable (s) which allow an malicious person (attacker or in other words pirate) to successfully exploit vulnerabilities and vulnerabilities in the network (s).

Statement of the invention:

First of all, in this patent application, network means: computer network. And what networks mean: computer networks. And what terminal means: computer terminal. And what terminals mean: computer terminals.

Reminder:

The previous defense procedures and logics - that is to say existing to date against computer attacks whether for spy (s), sabotage (s) or locking (s) against request (s) ) of ransom (s), consist in challenging, with a network (s) "frozen (s)", "static (s)" and "passive" secured by activity sensors (s) - logs - and analysis rules and equations for these activities (logs) aimed at the detection, alert and automatic or manual blocking of an intelligent attacker (s) ), active (s), dynamic (s) and sometimes stealthy (s).

What if we reverse the logic on the attacker? In other words, challenge the attacker with his own logic to cancel his effectiveness.

The invention consists of three methods of defense against computer attacks (threats).

A first method, called in this patent application method A, which is a method of defending an understandable / readable network, static, frozen in time, and passive, against computer attacks (threats).

Method A is characterized in (to) that it comprises the following stages, the first two of which are successive (and it should be noted that protection is sought for the following):

- Step 1): virtual transformation (in other words: transformation of appearance) of an understandable / readable network by the virtual inflation (of the verb to inflate) and / or the virtual deformation of a network (x ). The virtual transformation (in other words: transformation of the appearance) of an understandable / readable network can also be carried out by the creation of one or more virtual network (s) by means of one or more code ( computer science (s) to subsequently include one or more real network (s) in one or more virtual network (s) created. And this, to prevent / bias an effective reading / understanding made by an observation (phase 1 of the attack) made by a third party and thus make a real network undetectable in a virtual network and therefore illegible / incomprehensible to (for) its observer .

- Step 2): virtual transformation (or in other words: transformation of the appearance) of a “static” and “frozen in time” network into a “virtually dynamic and random in time” network (or in other words : apparently dynamic and random over time) by setting up one or more changing and / or random configuration (s) over time of a virtual network (created and added to a network real - or in which a real network (s) is (are) included (included) - and this, to make a real network undetectable and incomprehensible even via long-term or very long-term observation.

- Step 3): transformation of the passive characteristic of a network "when questioning a network by a third party by requests" and / or of network equipment and / or IT equipment, into passive / active characteristic. The transformation of the passive characteristic of a network which communicates passively (ie passively) the vulnerabilities “during questioning by a third party by requests” is carried out (is carried out) by the emission during questioning (ie requests) false information and / or false vulnerabilities and / or flaws through (via) the addition to a network of one or more computer codes.

Advantageously, in step 1), the virtual transformation and / or the virtual inflation and / or the virtual deformation of a network, that is to say also the virtual transformation and / or the virtual inflation and / or the virtual deformation of the infrastructure (infrastructures) of a network; that is to say also the virtual transformation and / or the virtual inflation and / or the virtual deformation of the computer equipment of a network, are carried out "by the cloning of the IT infrastructure" of a network and / or "by the cloning of IT equipment ”such as and this by way of explanation but not exclusive: terminals, computers, servers, printers, wifi access points, IPs, etc.

Advantageously, in step 1), the virtual transformation and / or the virtual inflation and / or the virtual deformation of a network (that is to say transform and / or deform and / or virtually inflate a network) by cloning the IT infrastructure and equipment is done - is (are) done - by the creation of X clones for each IT equipment or in other words for each IT equipment. Note that X means a variable constituting a variable number according to the choice of subsequent configuration of the user of Method A.

Advantageously, after step 1) of inflation, deformation and amplification and / or creation of one or more virtual network (s) by means of one or more code (s) computer (s) to subsequently include one or more real network (s) in one or more virtual network (s) created by one (or more) computer code (s) or by cloning a (of) network / cloning of (s) infrastructure (s) / cloning of equipment of (a) network (s), a step of creation and installation of "Mines" is carried out on the clones and / or on the virtual network (s) created by a computer code (s) and which includes (s) a real network (s) ).

Mines are "real" vacant IP addresses (hooking points sought by attackers) and real vulnerabilities left sciamently and installed on the Clones and / or on the virtual network (s) . Vacant PIs are equipped with (linked to) sensors (interceptors) to identify an illegitimate collision and linked to the alert system (s). The vulnerabilities on the Clones and / or the virtual network (s) are also used to incite exploitation on them to identify an attack and generate an alert. Being on Clones, they play the role of "advanced virtual security stations". The operation does not generate damage unlike an operation affecting the real network, which even if it is intercepted, it has already done (the) damage (s) / desired result (s) ).

The difference that characterizes innovation compared to conventional honey pots on a network is on the one hand "the presence of mines on Clones" and / or on one (or more) virtual network (s) (s) with the advantages mentioned above. On the other hand, the possibility of setting up for the first time beyond conventional honey pots, that is to say vacant IP addresses with sensors, vulnerabilities (flaws). The vulnerabilities (flaws) on the Clones and / or on a virtual network (s) created to include a real network (s) incite exploitation without damage and therefore without risk for a real network (s).

Note also that the operation of a Mine generates an alert but above all with a configurable probability of success upstream and therefore almost zero if desired and therefore a very high probability of alert and detection "without any damage" and therefore an alert and detection with the possibility of almost systematic automatic blocking. The attacker is thus faced with a kind of Russian roulette with an almost zero probability of success because configurable (controllable) by the target upstream.

And in that step 1) further includes a sub-step al):

- Sub step al) being a generation and / or maintenance of a virtual activity in an inflated and deformed network; which we can also call a virtual amplification of the activity (also called traffic) of a real and / or virtual network created by Cloning or by computer code (s). The generation and / or maintenance by means of one or more computer code (s) of a virtual activity (activities) and / or the virtual amplification of the activity of a network have the role of creating and / or maintaining a virtual activity (ies) and / or of amplifying the activity of a network by creating and generating a virtual activity (ies) - additional (s) - or in other words virtual (s) traffic (s) - additional (s) - on (in) Clones and Cloned equipment or in virtual networks created by computer code (s) , to prevent the distinction (identification) of Clones and Cloned equipment and / or to prevent the distinction (identification) of a virtual network by the absence of activity (s). Sub step a1) thus makes it possible to bias phases 1 and 2 of an attack as described in FIG. 1 of this patent application, namely the observation and listening of a network. And this to bias judgment (analysis) by observation and listening.

And in that step 3) also includes a sub-step a3):

- Step a3) is characterized by "scrambling", "biasing" the results of questions from the network and / or IT equipment by requests and "scrambling", "biasing" the results of vulnerability scanners ( Network and / or network equipment and / or IT equipment vulnerability scan tools).

Advantageously, in step a3), the scrambling (biasing) of the results is carried out "by saturation / by drowning", that is to say "by an emission (emissions)" during the questioning of a network, a number (which we recommend high) of "false information" and / or "false vulnerabilities". And this, to "saturate the results of the questions (the answers)" and "drown the real answers (results) in a very large quantity of false answers (results)".

Additional explanation:

Blur the results (the scrambling of the results) of the attempts (approaches) to questioning and / or the questioning of the network (s) by what are called requests by the emission of a very large number of false vulnerabilities (false results) which will be added to the real vulnerabilities (real results) to make the responses of a network on the vulnerabilities and faults present on the network at the time of the questioning (s) unusable.

Because to be able to prevent a hacker (a malicious person) from "interrogating" in an "effective" (or in other words, effectively) and in an "exploitable" manner, one or more networks must be:

- Or, prevent the network from talking (responding, communicating with the hacker). Which is impossible to date.

- Or, by the innovation of the “saturation / drowning request jammer” which we also call “saturation / drowning scanner jammer). That is to say, responding (by responding) to queries / questions and / or scanners with so much (say so) of false information to drown out the real answers (results) in a sea of false answers (false results).

Thus, the active jamming of requests and / or scanners by saturation (by drowning) by the emission on each request for a scanner (at each manual or automated questioning) which interrogates the network, a very large number of false vulnerabilities which will be added to the "real" vulnerabilities in the results (responses) to requests and / or in the results (responses) of scanners (Scan software). Interference thus drowns out “real” vulnerabilities in a sea of “fake” vulnerabilities.

This scrambling allows a drowning / saturation defense strategy that can also be called drowning coverage strategy. This technique reduces the attacker's "ability to analyze and exploit effectively" the responses collected and / or the data raised by his questions (his requests) and / or his (her) scan software (vulnerability scanners). Because the attacker will simply no longer be able to know which (which) of the vulnerabilities (responses) collected (s) is (are) true (s) and which (which) is (are) one (of) false (s) ) to find out which one (s) to use.

Important:

The percentage of “false” vulnerabilities (responses) issued being “configurable upstream” by the target makes it possible to obtain mathematically a (the) desired mathematical probability of success / failure of the exploitation (of the exploitations).

In addition, the more the number of “false” vulnerabilities (responses) is increased in the responses to the request (s) and / or in the result (s) of the scanners (this is to say Vulnerability Scan software), the more you mathematically reduce the probability of success and therefore the chance of success for an attacker. By issuing a very large number of “false” vulnerabilities (responses) in proportion to the “true” ones that one can naturally estimate upstream - one can arrive at an almost zero probability (chance) of success for an attacker.

Advantageously, in step a3), the jamming by saturation / by drowning is carried out by the emission of a large number of false information / responses (vulnerabilities) concerning a network and the equipment associated with a network by the through the addition of one or more computer code (s) programmed to send a large number of false information (vulnerabilities) to each request received by a network.

Advantageously, in step a3) the jamming by saturation / by drowning can also be carried out by the emission in a random manner at each request of a large number of false information (vulnerabilities) concerning a network and the associated equipment. to a network. That is to say by adding to the computer code (s) one (or more) algorithm (s) which randomly modify the false vulnerabilities to be issued.

Advantageously, in step a3) “the jamming by saturation / by drowning can also be achieved by adding a large number of false vulnerabilities and / or faults in one (of) virtual network (s) ( s) created by cloning or by computer code (s) to include a real network (s). The issue of false vulnerabilities (responses) is in this case systematic by mechanical effect of the addition of false vulnerabilities / faults in (on) one (or more) virtual network (s) which includes (s) one (or more) real network (s). In this case, issuing randomly is also possible through the addition of one (or more) algorithm (s) that randomly modify (s) the false vulnerabilities / vulnerabilities added and their locations in a (of) virtual network (s) which includes (s) a real network (s).

Another object of the invention is a device for defense against computer attacks which implements Method A (on the basis of Method A), consisting of three computer program products.

The computer program product called computer program product 1 in this patent application is:

- The Virtual Transformer / Inflator / Deformer of a computer network (of computer networks) by Cloning.

The virtual transformation / virtual inflation / virtual deformation of a network by cloning, that is to say also the virtual transformation / virtual inflation / virtual deformation of the infrastructure (infrastructures) of a network and it is also to say the virtual transformation / virtual inflation / virtual deformation of the computer equipment of a network, is (are) carried out "by cloning the infrastructure" of a network and "computer equipment of a network »As and by way of explanation but not exclusive: terminals, computers, servers, printers, wifi access points, IPs, etc.

The clones virtually inflate a network (and its appearance) and thus deform the infrastructure of the network (s) and bias the observation of the one (those) who are trying to observe it (observe them ) or in other words the one (those) who observes it (observing them). That is to say reflect a false image (s) of a real network (s).

The observation is also substitutable by network mapping software (s) which propose the automation of this task (phase) and draw up in a few minutes one (or more) mapping (s) of the (the) network (s) and infrastructure (infrastructures) and equipment (the IPs connected to a network or in other words the IPs relating to a network for example), the virtual inflator and deformer also biases the result (s) of this software which will draw up a map (s) filled with Clones. Or put another way, these software will include in their result (s) and therefore in their (s) mapping (s) Clones.

Virtual transformation and / or virtual inflation and / or virtual deformation of a network (that is to say transform and / or deform and / or virtually inflate a network) by cloning the infrastructure and IT equipment is (are) - is (are) made (s) - by the creation of X clones for each IT equipment (or for part of the IT equipment) or in other words by the creation of X Clones for each (or part) of IT equipment. Note that X signifies a variable constituting a variable number according to a choice of subsequent configuration by the user of Method A.

Once the transformation / deformation / inflation by Cloning done / done, one (of) module (s) allows (tent) a modification of (the) configuration (s) of the Clones and of (the) new (x) ) virtual network (s).

The manufacturer (s) deliver (s) a first version with a first configuration. Thereafter the (s) manufacturer (s) proceeds (s) to training the user (user personnel) for manual reconfiguration (simple by the way) that is to learn to user how to change the configuration manually. As well as training for setting up a automatically changing configuration on the basis of an algorithm (algorithm), the construction of which is made by the client in the program management modules. That is to say how to set up a changing configuration automatically on bases chosen by the user. Thereafter the manufacturer will no longer be able to know what (s) is (are) the configuration (s) set up with his (her) client (s).

For maximum security, we recommend:

- or, a change of configurations manually daily.

- or, for more comfort, that is to say not to have to manually change the configurations every day, we recommend the implementation of an automatic daily configuration change but to change the algorithms of the random configuration changes regularly; that is to say to change the rules of random changes manually regularly. This second possibility offers, in addition to comfort, security even vis-à-vis the personnel who configure the programs internally. Because he (the staff) will not be able to know the random choice of algorithms.

The computer program product called computer program product 2 in this patent application is:

- The generator / stabilizer of virtual IT activity (ies) and virtual amplifier of IT activity (ies) - of IT traffic (s).

The Generator / Stabilizer of Virtual Computer Activity (s) and Virtual Amplifier of Computer Activity (s) first analyzes the real activity and real traffic of a network real to dissect, analyze and memorize the activity (activities) of a real network, then create (generate) and maintain an activity (ies) and virtual traffic (s) "similar" (s) ”or said otherwise identical (s) to that (those) of a real network (s); and to those of real equipment and therefore to real infrastructure.

However, the activity (activities) and traffic (traffic) of the network (networks) of each target being different and therefore having particularities (specifics) specific to the target and dependent on its size, its usual IT activity, its activity in the broad sense, ie commercial, its working hours, the number of users, etc. ; it is preferable that the traffic (the activity of the clones for example in the event of cloning) is identical and specific to the real network (s) of the user so that the virtual activity (ies) ( Clones, for example in the event of cloning) are likely to be those of real equipment and that (s) of real infrastructure (infrastructure). And that the virtual traffic (s) consider specificities relating to the user of Method A described above, namely, his usual size, his computer activity - on the network (s) - and those of the users of its network (s), its activity in the broad sense, that is to say commercial, its working hours, the number of users, etc.

The computer program product called computer program product 3 in this patent application is:

- Active jammer of network vulnerabilities scanner (s) and computer equipment (s) by saturation / drowning.

[0106] The active jammer for scanning network vulnerabilities (x) and computer equipment (s) by saturation / drowning or in other words the (active) jammer for questions) manual or automated network (s) - or in other words the jammer (active) of manual or automated requests sent on a network (s) - or in other words the active jammer of vulnerability scanner (s) - or says otherwise, the active jammer of network interrogation and vulnerability collection software (s) - by saturation / drowning emits (verb emit - that is, has the role of emission) each time (during each questioning) - in other words, each (during each) request sent to a network (s) manually or via specialized software, of a (very high preferably) number of “false” vulnerabilities (responses) which will be added the results of the request (s) and / or scanners (Scan software).

The jammer provides the target with a defense (defense strategy) by saturation or in other words by drowning.

Because, to be able to prevent a hacker (a malicious person) from "interrogating" in an "effective" (or in other words, effectively) and in an "exploitable" manner, one or more networks must be:

- or, prevent the network from speaking (responding, communicating with the hacker). Which is impossible to date.

- or, by the innovation of the jammer by saturation / drowning, responding with so much (saying so much) false information (answers) to drown the real answers (results) in a sea of false answers (false results).

Thus, the active jamming of the scanner by saturation (by drowning) by the transmission to each scanner request (each manual or automated questioning) which interrogates a network, of a number (very important preferably) of " false "vulnerabilities which will be added to the" real "vulnerabilities in the results (responses) to the requests and / or in the results (responses) of the Scan software, allows to drown the" real "vulnerabilities in a sea of" false " vulnerabilities / flaws.

This scrambling allows a drowning / saturation defense strategy which can also be called drowning hedging strategy which reduces the attacker's ability to analyze and effectively use the responses collected by his request (s) manual (s) and / or the data raised by its vulnerability scan software (computer network scan). Because the attacker will simply no longer be able to know which (which) of vulnerabilities / flaws / results is (are) true and which (which) is (are) one (of) false (s) to know which one (s) to exploit.

[YES] Important:

The percentage of "false" vulnerabilities / false responses issued being "configurable upstream" by the target makes it possible to mathematically obtain a (the) desired mathematical probability of success / failure of the exploitation (of the exploitations).

In addition, the more the number of “false” vulnerabilities / flaws / responses is increased in the responses to the request (s) and / or in the result (s) of the scanners (this is ie Vulnerability Scan software), the more you mathematically reduce the probability of success and therefore the chance of success for an attacker. By issuing a very large number of “false” vulnerabilities / responses in proportion to the “true” ones - which one can naturally estimate upstream - one can arrive at an almost zero probability (chance) of success for an attacker.

The active jammer of network vulnerability scanner (s) and computer equipment (s) by saturation / drowning is also characterized by the existence - that is to say has (of) - it is to say offers, offers to its user - one (of) module (s) allowing the user to set up an algorithm of emission (s) of false vulnerabilities / random responses (randomly) in the time. That is to say on the basis of changing and random rules over time.

The active jammer for scanning network vulnerabilities (x) and computer equipment (s) by saturation / drowning is also characterized by the existence - that is to say has (a) - c 'is to say offers, offers its user one (or more) - module (s) allowing the user to change the algorithm for issuing false false vulnerabilities (responses) randomly.

The manufacturer (s) deliver (s) a first version with a first configuration. Thereafter the (s) manufacturer (s) proceeds (s) to training the user (user personnel) for manual reconfiguration (simple by the way) that is to learn to user how to change the configuration manually. And training for setting up a changing configuration automatically on the basis of one or more algorithm (s) whose construction (construction management) is done by the customer in the program management modules. That is to say training to teach the user how to set up a changing configuration automatically on bases of his choice. Thereafter the manufacturer will no longer be able to know what (s) is (are) the configuration (s) set up with his (her) client (s).

For “maximum” security, we recommend:

- or a change of configurations manually daily.

- or, for more comfort, that is to say not to have to manually change the configurations every day: the setting up of an automatic daily configuration change (s) but to change the configuration change algorithms (s) random (s) ie the rules of random changes manually regularly.

This second possibility offers, in addition to comfort, security even vis-à-vis the personnel who configure the programs internally. Because he (the staff) will not be able to know the random choice (s) of the algorithms.

The advantages of Method A and the computer program products 1, 2 and 3 which implement Method A compared to existing (previous) solutions beyond "the difference" which distinguish them from existing solutions and their complementarity to the existing are:

- Dynamicity and random characteristic over time.

- The Dynamicity and the random characteristic over time also offers security (protection) vis-à-vis long-term observations and surveillance. That is to say, the shape that the target wishes to give to its network (s) and the way in which it virtually transforms and / or inflates and / or deforms (in appearance) its network (its networks), its infrastructure (its infrastructures), its equipment, can be modified as many times as desired over time. Daily if desired. And thus prevents long monitoring to describe the network (s), to distinguish (identify) the real network (s), and thus thus prevents long monitoring to describe security (the defense logic) to divert it, beat it or even already understand it. Because you first need to understand a network (an infrastructure) to get into it and its security logic to divert it. The configuration of Computer Programs 1, 2 and 3 can be modified and should be changed regularly (and can be modified automatically or manually depending on the user's choice and this daily if desired by a simple automatic reconfiguration programmed at random or a simple quick manual reconfiguration) to cancel the effectiveness of an observation and a passive / active long-term analysis. Method A and Programs 1, 2 and 3 therefore allow security with a dynamic, active and above all random configuration over time.

- The protection of the user of Process A and computer programs 1,2 and 3 (the target) even against the inventor of the Process and the manufacturer (s) of programs 1, 2 and 3. Indeed, for the first time in the field of information system security, solutions offer the user to be protected even vis-à-vis the inventor of the Process and manufacturers (companies ) owners of security solutions (namely programs 1,2 and 3). Process A and computer program products 1, 2 and 3 offer, unlike existing solutions, protection for the user (the target) even vis-à-vis the inventor of the Process and the manufacturers of the tools ( solutions).

Explanation: to secure and / or prevent a target from an attack, the tools which analyze the networks (the logs) of the targets (of the users of these analysis tools), oblige the users of these solutions (the customers ) to open (absolutely require that users open) access (s) to their network (s) to the manufacturer (s) of the tool (tools).

Thanks to Method A and / or to the computer program products 1, 2 and 3, the client has security (of a security arsenal) which in no case requires feedback of information to his ( its) manufacturer (s).

The manufacturer (s) deliver (s) a first version with a first configuration. Subsequently the manufacturer (s) proceed (s) to training the user (reuse staff) for manual reconfiguration (simple by the way) that is to teach the user how to change the configuration manually. And training for setting up a automatically changing configuration based on an algorithm, the construction of which is done by the client in the program management modules. That is to say, how to set up a changing configuration automatically on the bases of your choice. Thereafter the manufacturer will no longer be able to know what (s) is (are) the configuration (s) set up with his (her) client (s).

For maximum security, we recommend:

- either, a change of configurations manually daily,

- or, for more comfort, that is to say not to have to manually change the configurations every day: the setting up of a daily automatic configuration change but to change the algorithms of the random configuration changes c ' ie the rules of random changes manually regularly. This second possibility offers, in addition to comfort, security even vis-à-vis the personnel who configure the programs internally. Because it will not be able to know the random choice of algorithms.

Conclusion on Method A and the computer program products which implement Method A:

This new process is inspired (based on) the attack processes to disturb them, slow them down, cancel their effectiveness (s) and thus amputate the attacker (attackers) by (their) three major forces to knowledge, intelligence, stealth, and the ability to hijack security devices by first reading / understanding by observing a network and defending devices from a network.

This method (Method A) structurally changes what we call "the game" between the attacker and the target. The game being beyond the technicality of the field: on the one hand an attacker who seeks to attack to spy, sabotage or lock against ransom demand and on the other hand a target who seeks to defend himself while developing and being therefore active by continuously generating legitimate daily computer logs.

This Method (Method A) transforms "the game" for the attacker into a nonintelligent game, in which his senses of observation and listening are biased, and in which his cunning, his spirit of analysis and its requests and tools (scanners) are no longer useful to him and quite simply puts him face to a new game: "a game of probability of success / failure configurable upstream by the target" and thus offering him a mathematical probability of almost zero success. With in addition to each test a virtually zero probability of not falling on "a Mine" and generating an alert without consequence on a network and which will cause each time the blocking of its IP address. Knowing that a hacker can have the possibility in a span of a month for example of having access to a dozen IP addresses maximum and this, if he has "logistics" and / or a capacity quite significant mobility (a kind of Russian roulette with an almost zero probability of survival).

The second Method, called in these documents Method B, is a Defense method against the electronic mail (s) (said emails - singular email) said trapped by the presence of code (s) malicious (s) or in other words virus or in other words infection or in other words Malware, in the attachments to its - their content (s) or in the hypertext link (s) of its (their ) content (s) by a new strategy called strategy of opening in a separate / isolated / non-sensitive environment.

This is to say by strategy of opening up to a separate and isolated network (s) and / or non-sensitive (s). That is to say by opening strategy on a separate computer terminal (s) and / or isolated and / or non-sensitive (s).

It should be noted that Method B is a Defense method against type 2 attack (s).

Recall that the electronic mail (s) (known as e-mails - singular e-mail) says trapped by the presence of malicious code (s) or says otherwise virus or says infection otherwise or in other words Malware, in the attachments to its - their content (s) or in the hypertext link (s) of its target content (s) attack (s) - a terminal (terminals) such as a computer) computers for example, etc.

Reminder:

- "Endpoint" that is to say tools (programs made of computer codes) which first memorize (save in a memory) the activity (activities) "called (s) normal (s)" of a terminal (ie a computer for example). Then send an alert (s) and / or block the terminal (terminals) if an activity (ies) different from that (s) "recorded in memory as being normal" is (are) detected on the terminal (the terminals); or in other words if an activity (ies) different from that (s) "recorded in the tool memory as being normal" is (are) detected.

We also recall the limit (s) or in other words, from the point of view of the attacker, the flaws of the endpoint solutions:

- Endpoints protect terminals that are connected to one (s) - (x) network (s). And are also used to prevent escalation from one terminal and / or multiple terminals.

- Endpoints are certainly effective but do not allow zero risk. An intelligent attacker, in the context of an attack for espionage or even for sabotage or locking against ransom may only work from the terminal during working hours and operate in such a way as to generate an activity deemed very legitimate because it is slow and similar to the activity of the legitimate user in their hands on the terminal.

-It can also be content to retrieve information on the terminal to avoid being detected by the firewall (s) and to have elements making it possible to better prepare (perfect) its attack and subsequently attack another terminal and move slowly and "let time pass between activities". Thus its activity (ies) on the terminal (terminals) protected by the endpoint (s) and firewall will (will) not be detected - judged - as illegitimate. Or when it (s) are (it will be), the attacker would have already managed to have information and / or to lock and / or sabotage the terminal.

- Recall that the idea (the strategy) of an attack (illegitimate activity) "not detected / not detectable" consists simply in adopting a behavior generating an activity "exactly similar" or failing that "almost similar" to that of a legitimate user who generates an activity as part of the exercise of his function and this "without duplicate (s)". The small risk taken by generating an activity that is almost similar and not exactly similar is not fatal because the identified and blocked attacker can allow time to pass and come back later on the same or another terminal. And these small risks taken will allow him to know the limits of the overflows that he can afford the next time.

[0132] Let us also recall the limits of anti-virus and anti-malware solutions:

- anti-virus and anti-malware protect terminals that are connected to the network (s) only. And to prevent escalation (or lateralization) from one terminal and / or several terminals.

- anti-virus and anti-malware are also an effective solution to protect a terminal (terminals). They detect the presence of "viruses", in other words "infections" and malicious code based on the basis (s) of what is called "a signature" or "signatures" of malicious code (s) (s) - viruses / infections. Signatures of malicious code (s) - of viruses / infections - are listed by the anti-virus and anti-malware manufacturers. Each Malware and virus having what we technically call a signature, entered in the database (s) of Anti-virus and Anti-Malware to detect them in the targets to be protected.

[0133] Or:

- when it is a new infection, anti-virus and anti-malware do not detect the signature because it is simply listed and therefore it is not saved in the database (s) ) of data. Malicious code must be used "at least" once to be identified.

- between the identification of a "new signature of infection" and the updating a delay is logically necessary. In addition, the target (targets) does not sometimes perform the update (s) immediately as soon as it (s) is (are) available (s) and proposed (s) by the manufacturer anti-virus and anti-malware.

Method B is characterized in that it comprises the following steps - note that steps 1) and 2) below of Method B are not necessarily successive; and note that protection is sought on the following -:

- step 1): identification and manual collection (by a human) and / or identification and automated collection by analysis (automated) on the basis of predefined rules and equations (computer codes), e-mails carrying and / or containing in their content (of) attachments and / or one (of) hypertext link (s).

- step 2): opening the attachment (s) and clicking (i.e. the action which consists of clicking) on the hypertext link (s) from 'an isolated (separate) environment or in other words an isolated (separate) environment. That is to say technically, the opening of the attachment (s) and the clicking (ie the action which consists in clicking) on the hypertext link (s) on one (from one) and / or (from) several isolated network (s), that is to say separated from the network (s) (IT) of the target.

That is to say also, technically, the opening of the attachment (s) and the clicking (ie the action which consists in clicking) on the link (s) hypertext on one (from one) and / or (from) several terminal (terminals) - computer (s) for example, etc. isolated / separated from the target network (s) (IT - IT). Note that a terminal (terminals) - computer (s) for example, etc. - isolated / separated from the computer network (s), i.e. technically a terminal (terminals) - computer (s) for example - connected (s) - connected (s) / installed (s) - on (to) a separate / isolated network (s).

In other words, opening the attachment (s) and clicking (i.e. the action which consists of clicking) on the hypertext link (s) on (from) from a terminal (terminals) - in other words on a terminal (terminals) - connected and / or installed to / on a network (s) separate from that (those) of the target (s).

Note that an isolated, separate computer network (s) means: a computer network (s) - separate / isolated from ( of the target computer network (s).

Note that a terminal (terminals) - computer (s) for example, etc. - isolated (s) / separate (s) from the network (s) - IT (s) - means: a terminal (terminals)

- computer (s) for example, etc. - installed (s) / connected (s) to an isolated / separate network (s). Recall that an isolated, separate computer network (s) means: one (s) - computer network (s) - separate / isolated from ( of the target computer network (s).

Note (note) that an isolated, separate computer network (s) may also be substituted by a non-responsive computer network (s) . A non-sensitive computer network (s) means a network (networks) which in the event of infection on (inside), does not cause (s) - does not present (s) - a (of) major or significant risk (s) and / or major (or significant) damage (s) for the target (a target).

Note (also) that a terminal (terminals) - computer (s) for example, etc. - isolated / separated from the target computer network (s) can also be substituted by a non-sensitive computer terminal (s) ). A non-sensitive computer terminal (s) i.e. a terminal (terminals) which in the event of infection on (inside), does not cause (s) - does not present (s) no - a (major) or significant risk (s) and / or (a) major or significant damage (s) to the target (a target).

- step 3): the return of the files and / or data retrieved from the hypertext link (s) and / or the open attachment (s) (i.e. after their opening and clicking on it) on the isolated network (s), separate (s) or in other words open (i.e. after opening and clicking on it) on the network (s) x) isolated, separate or in other words from the isolated network (s), separated, towards the initial recipient (s).

Another object of the invention is a device for carrying out defense against computer attacks on the basis of Method B, that is to say a device for carrying out defense against computer attacks characterized in (a) that 'it implements Method B and consisting of a computer program product called computer program product 4 in this patent application.

The computer defense program product against trapped e-mail called computer program product 4 in this patent application is:

- The product computer program for defense against e-mails trapped by the strategy of opening up on an isolated computer network (s) / separate / non-sensitive.

In other words, the defense program against e-mails trapped by the strategy of opening in an isolated / separate / non-sensitive environment (environment).

In this patent application appears two Methods (types / logic) of coding computer coding (s) - possible for the computer program product 4. It should be noted that other coding methods (logic (s) computer coding (s) are also possible to implement Method B and will be indicated in future versions of the computer program product 4.

In this patent application, we call the first coding method (first type / first logic) or in other words the first code: Code 1.

In this patent application, we call the second coding method (second logic / second type) or in other words the second code: Code 2.

Note also that "emails" means in this patent application: emails. And that "email" means: electronic mail [0141] Note that in this patent application the electronic mail (s) having (bearing) in its (their) content (s) one or more link ( s) hypertext and / or one (s) attachment (s) or in other words the electronic mail (s) carrying one or more hypertext link (s) and / or one (s) (s) attached (s) is (are) also sometimes called (s): emails at risk.

Note that in this patent application (specifically in the implementation of Method B by the computer program product 4 and by the computer program product 5 below) a platform is called: "Email Center at Risk ”or sometimes“ the Central of Risky E-mails ”. Note also that "Central Risk Mail" is sometimes cited thanks to (by) its acronym, "CCR"; and that "the Central of Risk E-mails" is sometimes cited thanks to (by) its acronym, "CCR".

Here is the definition and detailed description of the Risk E-Mail Central (CCR): The Risk E-Mail Central (CCR) is an installed platform (to be installed) and / or connected (to be connected) on (to) a terminal (terminals) - computers) for example, etc. - installed (s) (to be installed) and connected (s) (to be connected) on (to) a separate network (s) - isolated from the user's network (networks) ( of the target) and (we recommend that it be) dedicated "preferably but not necessarily" exclusively (only) to the anti-trapped email processing activity.

Note that a - the - (of - the) separate network (s) as described above (precisely on page 19 of this patent application) is (are) called ( s) also sometimes in this patent application the CCR network (s) or "the isolated network (s)".

Note that one (that) terminal (terminals - terminals) - computer (s) for example, etc. - separate (s) / isolated (s) / non-sensitive (s) from the network (s) - IT (s) - as described above (precisely on page 19 of this request for patent) is (are) also sometimes called (s) in this patent application "CCR terminal" or "CCR terminals" or "separate terminals" or "isolated terminals" or "non-sensitive terminals". Note that a non-sensitive terminal (s) means a terminal (terminals) which in the event of infection on (inside), does not cause (s) - does not present (s) - a ( major or significant risk ^ and / or major or significant damage to the target (a target).

Recall that a network (networks) computer (s) isolated (s) / separate (s) from the network (s) computer (s) of the target (targets) can (can) also be substituted (s) by a non-sensitive computer network (s). A non-sensitive computer network (s) means a network (networks) which in the event of infection on (inside), does not cause (s) - does not present (s) - a (major or significant risk (s) ^) and / or major or significant damage (s) to the target (a target).

It should also be remembered that a terminal (terminals) - computer (s) for example, etc. isolated / separate (s) from the IT network (s) of the target (targets) can (can) also be substituted by a non-IT terminal (s) -sensitive (s). A non-sensitive computer terminal (s), i.e. a terminal (terminals) which in the event of infection on (inside), does not cause (s) - does not present (s) no - major or significant risk (s) ^ and / or major or significant damage (s) to the target (a target).

We therefore note that the Central Risk Mail (CCR) can also be a platform installed (to install) and / or connected (to connect) on (to) a terminal (terminals) - computer (s) for example , etc. - installed (s) (to be installed) and connected (s) (to be connected) on (to) a non-sensitive computer network (s).

Let us not forget that non-sensitive computer network (s), that is to say a network (of networks) which in the event of infection above (inside), does not cause (s) - does not present (not) - one (or more) major or significant risk (s) and / or (one) major or significant damage (s) to the target (a target).

And that a non-sensitive computer terminal (s), that is to say a terminal (of terminals) which in the event of infection above (inside), does not cause (s) - does not present (s) - one (or more) major or significant risk (s) and / or one (or more) major or significant damage (s) to the target (a target).

Here below, the description of the product computer program 4 on the basis of code 1 (and note that protection is sought on the following):

First function (or function 1) of the product Computer program 4 on the basis of code 1:

- analysis (analysis) of one (s) email (s) received (i.e. incoming / inbound) on the basis of predefined rules (computer codes) that can be modified and identification (identification) of the (of) email (s) at risk. Risky email (s) means: email (s) having / comprising in its content (s) - carrying- one or more hypertext link (s) and / or one or more attachment (s) . Additional detailed explanation: the first function of Computer Program 4 on the basis of code 1 is to analyze the email (s) received, that is to say incoming (s) as soon as they are received; and this on the basis of modifiable predefined rules to identify (locate) among the incoming emails (received) that (those) having / comprising in its (their) content (s) carrying- one or more hypertext link (s) and / or one or more attachment (s) that can also be called attachment file (s) and / or attached document (s); and this before its (their) opening (s) by the recipient (s) of the email (s) having / comprising in its (their) content (s) - carrying- one or more link (s) hypertext and / or one or more attachment (s). Within this function 1 (first function) two sub-functions are possible in the form of options and left to the choice of the user. These two sub-functions within function 1 are called in this patent application: option 1 and option 2 (respectively).

Option 1: the product Computer program 4 marks the at-risk email (s) (as defined in this patent application) with a visual marking (visual signal) in the inbox of the ) recipient (s). By adding a written mention. The written mention is by way of non-exclusive example: Do not open! Email awaiting anti-entrapment treatment before opening authorization!

Option 2: the Computer Program 4 product removes the risky email (s) (as defined in this patent application) from the recipient's mailbox (es) (s) risky emails.

[0155] Second function (or function 2) of the product Computer program 4 on the basis of code 1:

- Collection (collection) of email (s) at risk.

Third function (or function 3) of the product Computer program 4 on the basis of code 1:

- Backup (backup) of the email (s) at risk as well as backup of the email address (es) of the associated recipient (s). Note that recipients mean in the description of computer program 4 of this patent application: recipient (s) of risk emails (risk emails as defined in this patent application).

Fourth function (or function 4) of the product Computer program 4 on the basis of code 1:

- Granting (granting) - generating - of a registration number to - for - each saved risk email and saving this registration number by associating it in the memory of the computer program 4 to the e-mail address (e-mail addresses) of the recipient (s) (already saved) of the risk e-mail (s). Recall that recipients mean in the description of the computer program 4 of this patent application: recipient (s) of risk emails (risk emails as defined in this patent application).

[0158] Fifth (optional) function - or optional function 5 - of the Computer Program 4 product on the basis of code 1:

- Encryption (encryption) of the content (s) of the email (s) at risk. That is to say the encryption of the content (s) of the electronic mail (s) having (bearing) in its (their) content (s) - carrying - one or more link (s) hypertext and / or one (or more) attachment (s).

[0159] Sixth function (or function 6) of the Computer Program 4 product on the basis of code 1:

- Sending (sending) of the email (s) - encrypted if the user chooses to activate the encryption option, i.e. if the user chooses to activate the fifth optional function of the product Computer program 4 on the basis of code 1, described above - on (to) a platform separate / isolated from the network of the user (of the target); baptized and called in this patent application "the Central of Risk E-mails" called (cited) sometimes also in this patent application by its acronym, namely "CCR".

Let us recall the definition and the detailed description of the Central Risk Mail Office (CCR):

- The Risk Mail Center (CCR) is a platform installed (to be installed) and / or connected (to be connected) on (to) a terminal (terminals) - computer (s) for example, etc. - installed (s) (to be installed) and connected (s) (to be connected) on (to) a separate network (s) - isolated from the user's network (networks) ( of the target) and (we recommend that it be) dedicated "preferably but not necessarily" exclusively (only) to the anti-trapped email processing activity.

Note that the separate network (s) described above is (are) also sometimes called in this patent application the CCR network (s) or “ the isolated network (s) ”.

Recall that an isolated computer network (s), separate from the computer network (s) of the target (targets) can also be substituted (s) by a non-sensitive computer network (s). A non-sensitive computer network (s), i.e. a network (networks) which in the event of infection on (inside), does not cause (s) - does not present (s) no - a major or significant risk (s) ^ and / or a major or significant damage (s) to the target (a target).

We also recall that a terminal (terminals) - computer (s) for example, etc. - isolated / separated from the target computer network (s) can also be substituted by a non-sensitive computer terminal (s) (s). A non-sensitive computer terminal (s) i.e. a terminal (terminals) which in the event of infection on (inside), does not cause (s) - does not present (s) no - a major or significant risk (s) and / or major or significant damage (s) to the target (a target).

It should therefore be noted that the Risk Mail Center (CCR) can also be a platform installed (to be installed) and / or connected (to be connected) on (to) a terminal (terminals) - computer (s) for example , etc. - installed (s) (to be installed) and connected (s) (to be connected) on (to) a non-sensitive computer network (s).

A non-sensitive computer network (s), that is to say a network (of networks) which, in the event of infection above (inside), does not cause (s) - does not present (s) not a major or significant risk (s) and / or a major or significant damage (s) for the target (a target).

And a non-sensitive computer terminal (s), that is to say a terminal (of terminals) which, in the event of infection above (inside), does not cause (s) - does not not present - a major or significant risk (s) and / or major or significant damage (s) to the target (a target) .

Let us recall that a separate network (s) as described above is (are) also sometimes called in this patent application: "network (x ) CCR "or" separate network (s) "or" isolated network (s) "or" CCR network ".

[0168] At this stage, two "human treatment" stages are necessary. These two stages of human treatment are called in this patent application: stage 1 and stage 2.

Note however that these two steps can be automated. And note that the automation of these two steps is already planned in the next version of computer program product 4.

Step 1 (step 1) of human processing:

- One or more human (s), depending on the volume of risky emails received by the recipient (s) of the risky email (s) - presenting a risk of infection (s) proceed (s) ) at the opening (at the openings) of the attachments to the risk email (s) file (s) attached to the risk email (s) / documents attached to the report (s) ) at risk ; and click (s) on the hypertext link (s) present in the content (s) of - or in other words attached to the risky or otherwise transported coumel (s) s) by e-mail (s) at risk to access the document (s) - file (s) - associated (s); and this from the terminal (terminals) - computer (s) for example, etc. - installed (s) and connected (s) to the separate / isolated / isolated network / "CCR network (s)". Or in other words from (on) the CCR (the Central Risk Mail).

Stage 2 (stage 2) of human treatment:

- One or more human (s), depending on the volume of emails at risk received by the target (targets) - user (users) of the computer program 4 -, “proceeds (s) to the reintegration (s) into the product program computer 4 of the attachment (s) already open on the separate isolated network (s) - CCR network (s) - and documents ( s) - file (s) / information (s) - retrieved from the link (s) on which the human (humans) clicked (s) from the network (x ) separate isolated (s) / CCR network (s). That is also to say: one or more human (s), depending on the volume of at-risk e-mails received by the target (the targets) - user (users) of the computer program 4 -, "proceeds (s) to the reintegration into the computer program product 4 of the attachment (s) already open on the separate isolated network (s) / network (s) CCR and documents (s) - file (s) / information ^) - retrieved from the link (s) on which the human (humans) clicked CCR terminal (s) / separate terminal (s) as described (defined) in this patent application. And / or files (documents) retrieved from the hypertext link (s) found in the e-mail (s). During this step 2, the human (humans) associate (s) the files and documents with the registration number (s) of the email (s) 1 '(s) having transported (s) in their content (s).

Remember that these two steps can be automated.

And remember that the automation of these two steps is already planned in the next version of the computer program product 4.

[0174] Seventh function (function 7) of the product Computer program 4 on the basis of code 1:

- the decryption of email (of email / emails) at risk if the target (user of computer program 4) opts (has opted) for the activation of the encryption option; that is, if the target (user of computer program 4) opts (has opted) for the activation of function 5 (five) of the product Computer program 4 on the basis of code 1. Function 5 as as described above.

Eighth function (function 8) of the product Computer program 4 on the basis of code 1:

- Sending (sending) - or in other words referring (returning) - of the attachment (s) and / or file (s) / document (s) reintegrated / reintegrated (es) ) / reintegrated by the human (humans) or automatically during the next version of the product Computer program 4 on the basis of code 1, in the product Computer program 4 on the basis of code 1 to the initial recipient (s) of the risky account (s).

Note that at this stage, the electronic address (es) of the initial recipient (s) has (have) already been saved in the memory (the memories) product Computer program 4 based on code 1; and that the e-mail address (es) of the initial recipient (s) has already been associated with a number (s) already generated by the product Computer program 4 on the basis of code 1; and that this (these) number (s) is (are) called (s) above registration number (s).

[0177] Ninth function (function 9) of the Computer Program 4 product on the basis of code 1:

- sending of (a) request (s) - sending of (a) request (s) - of confirmation of (the) receipt of the email (s) and document (s) / document ( s) / attached file (s) / attached (s). Clarifications that the confirmation request (s) is (are) sent (s) to the initial / initial (therefore also final / final) recipient (s) of the email (s) at risk.

[0178] Tenth function (function 10) of the product Computer program 4 on the basis of code 1:

- deletion (deletion) of the email (s) from the memory (memories) of the product Computer program 4 on the basis of code 1, after the initial recipient (s) acknowledge (s) ) - have acknowledged - receipt of the email (s) after the anti-entrapment treatment of Method B.

Clarifications that the confirmation of receipt via an acknowledgment (of acknowledgments) of receipt "must" include confirmation of the correct opening of the document (s), in other words of the file (s) / document (s) attached (s) and / or before their removal from the CCR.

Here is the description of the computer program product 4 based on the code 2.

First function (or function 1) of the product Computer program 4 on the basis of code 2:

- automatic and systematic redirection (redirection) of all emails received, i.e. technically speaking: incoming emails - to the CCR. And this upon receipt (entry). The emails are therefore not (at this stage) accessible by the - to (the) - recipient (s) of the emails.

[0182] Second function (or function 2) of the product Computer program 4 on the basis of code 2:

- analysis (analysis) of one (s) email (s) received (i.e. incoming) - on the basis of predefined rules (computer codes) that can be modified and identification (identification) “At-risk email (s)” in (on) the CCR. And this before giving access to emails (or after but we recommend before) to staff working on (at) the CCR.

[0183] Let us recall that in this patent application the electronic mail (s) having (bearing) in its (their) content (s) - carrying - one or more hypertext link (s) and / or bearing / carrying one or more attachment (s) is (are) also sometimes called (s): emails at risk.

[0184] So let's also remember that "risky email (s)" means: electronic mail (s) having (bearing) in its (their) content (s) - carrying - one or more links (s) hypertext and / or one or more attachment (s).

[0185] Third function (or function 3) of the product Computer program 4 on the basis of code 2:

- collection (collection) on the CCP of emails at risk. That is to say collection of electronic mail (s) having (bearing) in its (their) content (s) - carrying one or more hypertext link (s) and / or one or more piece (s) ) attached.

[0186] Fourth function (or function 4) of the product Computer program 4 on the basis of code 2:

- backup (backup) of the risky email (s), that is to say of the email (s) having (bearing) in its (their) content (s) - carrying one or several hypertext link (s) and / or one or more attachment (s); as well as the backup of the email address (es) of the associated recipient (s). Note that the associated recipient (s) means the recipient (s) of the risky email (s), i.e. the recipient (s) of the ) electronic mail (s) having (bearing) in its (their) content (s) - carrying one or more hypertext link (s) and / or one or more attachment (s).

[0187] Fifth function (optional) - function 5 optional - of the Computer Program 4 product on the basis of code 2:

- granting (granting) - in other words generation (generation) - of a registration number to (for) each e-mail saved and the saving of this registration number by associating it in the memory (the memories) from computer program 4 to the email address (es) of the email recipient (s). Note that the electronic address (e-mail addresses) of the recipient (s) is (are) at this stage already saved in the memory (memories) of computer program 4 on the basis of code 2 .

[0188] Sixth function (optional) - function 6 optional - of the Computer Program 4 product on the basis of code 2:

- encryption (encryption) of the content (s) of the e-mail (s) at risk. That is to say the encryption of the content (s) of the electronic mail (s) having (bearing) in its (their) content (s) - carrying - one or more link (s) hypertext and / or one or more attachment (s).

[0189] Seventh function (or function 7) of the product Computer program 4 on the basis of code 2:

- sending (sending) - or in other words forwarding (forwarding) - of the email (s) not including in (its) their content (s) nor one (or more) attachment (s) nor one (s) hypertext link (s) to the initial recipient (s) of the email (s).

At this stage, two “human treatment” stages are necessary. These two stages of human treatment are called in this patent application: stage 1 and stage 2.

It should be noted that these two steps are, in this first version, identical in the computer program product 4 on the basis of Code 1 and in the computer program product 4 on the basis of code 2.

Remember that these two steps can be automated.

And remember that the automation of these two stages is already planned in the next version of the computer program product 4.

Let us recall these two stages.

Stage 1 (stage 1) of human treatment:

- one or more human (s), depending on the volume of risky emails received by the recipient (s) of the risky email (s) - presenting a risk of infection (s) proceed (s) ) at the opening (at the openings) of the attachments to the risk e-mail (s) / file (s) attached to the risk e-mail (s) / documents attached to the e-mail (s) s) at risk; and click (s) on the hypertext link (s) present in the content (s) of - or in other words attached to (e) email (s) at risk or said otherwise transported ( s) by risky email (s) to access the associated document (s) / file (s); and this from the terminal (terminals) - computer (s) for example, etc. - installed (s) and connected (s) to the separate / isolated / isolated network / "CCR network (s)". Or in other words from (on) the CCR (the Central Risk Mail).

Stage 2 (stage 2) of human treatment:

- one or more human (s), depending on the volume of at-risk e-mails received by the addressee (the addressees) - user (s) of the computer program 4 -, computer 4 of the attachment (s) already open on the separate isolated network (s) - CCR network (s) - and documents ( s) / file (s) / information (s) - retrieved from the link (s) on which the human (humans) clicked (s) from the network (x ) separate isolated (s) / CCR network (s). That is also to say: one or more human (s), depending on the volume of at-risk e-mails received by the target (targets) - user (s) of the computer program 4 -, "proceeds (s) to the reintegration into the computer program product 4 of the attachment (s) already open on the separate isolated network (s) / network (s) CCR and documents (s) / file (s) / information (s) - retrieved from the link (s) on which the human (humans) clicked from the CCR terminal (s) / separate terminal (s) as described (and defined) in this patent application; and / or files (documents) retrieved from the hypertext link (s) in the at-risk e-mail (s). During this step 2, humans (humans) associate (s) the file (s) and document (s) with the registration number (s) of the email (s) l '(the) having transported in their content (s).

Remember that these two steps can be automated.

And remember that the automation of these two steps is already planned in the next version of the computer program product 4.

[0199] Eighth function (function 8) of the product Computer program 4 on the basis of code 1:

- sending (the sending) - or in other words sending back (the sending back) - of the attachment (s) and / or file (s) / document (s) - reintegrated by humans (the human) or automatically in the next version of the Computer program 4 product based on code 2, in the Computer program 4 product based on code 2 to the initial recipient (s) (initials) risky email (s).

Note that at this stage, the electronic address (es) of the initial recipient (s) has (have) already been saved in the memory (the memories) product Computer program 4 based on code 2; and that the email address (es) of the initial recipient (s) has (have) already been associated with one (s) already generated (s) by the product Computer program 4 on the basis of code 2; and that this (these) number (s) is (are) called (s) above registration number (s).

[0201] Ninth function (function 9) of the Computer Program 4 product based on code 2:

- sending of (a) request (s) - sending of (a) request (s) - of confirmation of (the) receipt of the email (s) and document (s) / document ( s) / attached file (s) / attached (s). Clarifications that the confirmation request (s) is (are) sent (s) to the initial / initial (therefore also final / final) recipient (s) of the email (s) at risk.

[0202] Tenth function (function 9) of the product Computer program 4 on the basis of code 2:

- deletion (deletion) of the email (s) from the memory of the product Computer program 4 on the basis of code 2 after the recipient (s) acknowledge (s) - have acknowledged - receipt of (the) email (s) after its (their) opening on the CCP / on an isolated network (s) / on a separate / non-responsive network (s) also say on an isolated terminal (terrestrial) / separate (s) / non-sensitive (s).

Note that the confirmation of receipt via an acknowledgment of receipt "must" include confirmation of the correct opening of the document (s), in other words of the file (s), before their deletion. the CCR.

[0204] Finally, note that with regard to Method B and the computer program product

4, the e-mail (s) received (i.e. incoming e-mail (s)) includes (included) e-mail sent to the target by a (of) external person (s) and / or e-mails sent to the target (s) by an internal user (s). So the e-mail (s) received (i.e. incoming e-mail (s)) includes (included) the e-mail sent to the target (to the targets) by the through an external and / or internal electronic address (es).

The advantage of Method B and the computer program product 4 which implements Method B compared to existing (previous) solutions are:

- the indisputable advantage is the reduction in the risk of infection "to zero". The infections / viruses / malicious codes being executable (ie being operational) only when opening the attachment (s) and / or when clicking on the link (s) s) hypertext. And the opening of the attachment (s) and / or the click (click action) on the hypertext link (s) is carried out (are carried out) via Method B and the product program computer 4 far from the network (s) and target computer terminals: on a network (s) - and separate - isolated / computer terminals (s) and / or on a ( non-sensitive computer network (s) and terminals (s) as described in the descriptions of Method B and the computer program product 4.

The third Method of the invention is called in these documents Method C. Here is the description of Method C below:

But first, remember, one (s) attacker (s) - hacker (s) - can (can) take advantage

- and generally benefit (s) when he (s) is not (are not) a novice (s) - a moment of occasional absence (leave, etc.) or can (can) provoke - and provokes ( nt) generally when it (s) has (have) creativity - an absence (s) of one or more user (s) legitithne (s) on a network (s) - accident, invitation , appointments, etc. -, to generate an activity (activities) from its terminal (their terminals) and / or its IP address (their IP addresses).

This activity (these activities) - that is to say in the absence of the user (of the users) Legithne (s) - will not be (will) be judged as being illegitimate (s) - suspicious (s) - by the analysis tool (tools) because the analysis tool (tools) "which detects (s) duplicates" will not detect "duplicates". Duplicate (s) means two (or more) identical IP addresses generating one (of) activity (s) (operating) on one (s) network (s) from two (or more) different terminals.

Method C is a method for detecting illegitimate activity (ies) / presence (s) on a computer network (s) by comparing “presence data” (s) and / or physical absence (s) "of legitimate users to" computer activity data (s) of legitithne (s) users ". Note that protection is sought on the following:

Method C includes a sub-step Cl).

Step C1) being characterized by the detection on (one) computer network (s) of (d ¹ ) illegitimate activity (ies) by the comparison of (the) data of presence (s) / physical absence (s) of a legitimate user (legitimate user of an IP address, as a non-exclusive example) to activity on a computer network (s) ( s) of this same legitimate user (of the IP address of this same legitimate user, as a non-exclusive example).

Another object of the invention is a device for carrying out defense against computer attacks on the basis of Method C, that is to say a device for carrying out defense against computer attacks characterized in (a) that 'it implements Method C and consisting of a computer program product called computer program product 5 in this patent application.

The computer program product called computer program product 5 in this patent application and characterized in that it implements Method C is:

- An illegitimate activity detector (s) by comparing the activity of an IP address on a computer network with the physical presence / absence data of its legitimate user. Or put another way: an illegitimate activity detector (s) by comparing the activity of an IP address on a computer network with the physical presence / absence data of the legitimate user of this same IP address.

This detector is a computer program product for detecting illegitimate activity (ies) on a network (and for detecting intrusion exploitation) by comparing (comparisons) of data. presence (s) / physical absence (s) of legitimate users of IT activity data of legitimate users.

It should be noted that this detector, that is to say the computer program product 5, implements Method C on the basis of a coding method - of computer coding logic (s) - but that other coding methods (s) - coding logic (s) are also possible to implement Method C via one or more other product (s) computer program (s).

[0216] Note also that other coding methods (s) - coding logic (s) implementing Method C are planned in the next version of computer program 5.

Here is the description of the computer program product 5.

The computer proramme product 5 detects illegitimate activity (ies) on a network (s) by comparing the physical presence (s) / absence (s) data (s) of the legitimate user of an IP address active on a computer network with the same IP address.

[0219] First function (or function 1) of the computer program product 5:

- storage (storage) of (of) data that the target (user of the computer program product 5) integrates into the memory of the computer program 5.

This means that the computer program 5 stores in its memory data that the target (user of the computer program product 5) integrates with it (must integrate with it).

[0221] The data to be integrated in this first version of the computer program product 5 are:

- a) the IP address (ΓΙΡ) of each legitimate user on the target network (s) (user of the computer program product 5).

- b) the number of the access card - access badge as a non-exclusive example, etc.

- of each legitimate user on the target network (s) (user of the computer program product 5) as recorded in the access point database (gateways access as a non-exclusive example, etc.).

- c) the registration number (s) of the vehicle (s) of each legitimate user on the target network (s) (user of the computer program product 5).

The computer program 5 associates at this stage (that is to say during storage) the data b) and c) with the data (s) a).

[0223] That is to say the computer program 5 associates the number of the access card, access badge, etc. - the legitimate user on the computer network (s) as registered as recorded in the database of access points (access doors, etc.) as well as the (the) registration number (s) of the vehicle (s) of the legitimate user on the computer network (s) at the IP address (ΓΙΡ) granted to the same legitimate user on the network (s).

[0224] Second function (or function 2) of the Computer Program 5 product:

- collection (collection) via (by) one (of) access that we give (open) to the computer program 5 to what we call in this patent application and that we define below: attendance data and the physical absence of a legitimate user on a computer network (s).

That is to say the computer program 5 connects via (by) one (of) access that is given to the computer program 5 to what we call in this patent application and which we define here. below: data on the presence and physical absence of a legitimate user on a network (s) and collects the data on the presence and physical absence of a legitimate user on one (s) computer network (s).

Definition of the presence and physical absence data of a legitimate user on a network (s):

- the data of presence and physical absence of a legitimate user on one (of) network (s) are: all the data "computerized" or "to be computerized" concerning - relating to - the presence and / or absence of a legitimate user on a (a) network.

In this first version of the computer program product 5, the data for the presence and physical absence of a legitimate user on a computer network (s) are:

- a) data from access databases (access points - inputs / outputs) - badge access doors as a non-exclusive example, etc. - recording (which record) "the entry" and the exact time of entry as well as "the exit" and the exact time of exit of the legitimate user. Access database data (access points - entrances / exits) such as access doors (badge access doors, etc.) recording (which record) "entry" and time exact entry as well as "exit" and the exact exit time of the legitimate user are also sometimes called in this patent application: Database 1 or BDD1.

- b) The data of the surveillance camera (s) - called intelligent (s) - of the parking lot (s) recording (which record) "the entry" and the exact time of entry as well that the exit and the exact time of exit from the vehicle of the user (s) A surveillance camera - called intelligent - is a surveillance camera which transcribes - identifies and / or identifies and / or notes in a database (s) the number of the license plate of a car by filming, that is to say also a camera which locates and / or identifies and / or records in the form of numbers and letters in a database the number of the number plate of a car by filming it. The data from the (so-called intelligent) surveillance cameras of the parking lot (s) recording (which record) "the entry" and the exact time of entry as well as the exit and the exact time of exit from the user (of users) are also sometimes called in this patent application: Database 2 or BDD2.

[0228] Third function (or function 3) of the Computer Program 5 product:

- collection (collection) via (by) one (of) access that is given to the computer program 5 to what we call in this patent application: the data of computer activities of one (of) user (s) s) on a computer network (s).

That is to say, the computer program 5 is connected via (by) one (of) access which is given to the computer program 5 to what we call in this patent application: the data of 'IT activities of a user (s) on a network (s)). This is to retrieve the logs indicating (which indicate) the activity or (the absence of activity) of an IP address (or in other words the activity coming from - coming from - an IP).

The logs indicate at the same time which IP (s) is (are) active (s) on the network (s) and which IP (s) is (are) inactive (s). In other words, the logs indicate at the same time which IP (s) is (are) active - generates (s) activity - on the computer network (s) ^) and which IP (s) is (are ) inactive (s) - that is, which IP address (es) does not generate activity on the network (s).

Therefore, the data of computer activities of a user (s) on a computer network (s) are, technically speaking, in this first version of the computer program product 5: the logs .

In this first version of the computer program product 5, the computer activity data of a user (of the users) on a network (of networks), the logs - are to be retrieved by the computer program 5 via log sensors to be installed on the network (s) of the user of the product computer program 5 (the target). That is to say that the log recovery is carried out via log sensors to be installed on the network (s) of the user of the computer program product 5 (the target).

The recovery (collection) of the logs can also be carried out (is also carried out) by a connection to the databases of the tools (software programs) SIEM or in other words can also be carried out (is also carried out) by a connection to data from tools (software - programs) called SIEM analysis (described in the beginning of this patent application).

Because in the event of the presence of SIEM tools (software - programs) at the target, the connection to the data (logs) of the SIEM tools is intended to avoid unnecessarily reinstalling log sensors since the latter ( i.e. log sensors) are already installed for SIEM analysis.

The data of computer activities of a user (of the users) on a network (of networks) computer (s) - the logs - that they are recovered directly by dedicated sensors or recovered in the data of the programs of SIEM analysis with sensors are also sometimes called in this patent application: Database 3 or BDD3.

[0236] The active IP numbers in database 3 (BDD3) are called in this patent application: IP-Actives-BDD3.

[0237] Fourth function of the computer program product 5:

- updating of data from BDD1 and BDD2 and BDD3. We recommend updating every “thirty seconds”. Otherwise every "X seconds" such that X is an integer to be defined by the user of the computer program product 5.

[0238] Fifth function of the computer program product 5:

- comparison (comparison) of the data collected from BDD1 and BDD2 with data from BDD3. That is, comparing the data from BDD1 and BDD2 to the data from BDD3.

That is to say, the computer program compares the data collected from BDD1 and BDD2 with the data from BDD3 and sends an alert if an IP address (IP addresses) of one (or more) user (s) is (are) active on a computer network - i.e. generates (s) activity on a computer network, i.e. is (are) at the origin of activity on a computer network, and that the database BDD1 and / or the database BDD2 indicates (s) an exit and / or physical absence of a legitimate user whose IP address is indicated Active in the database BDD3.

That is to say, the computer program compares the data collected from BDD1 and BDD2 with the data from BDD3 and sends an alert if one or more IPs appear (s) among the numbers (in the database of) IP-Actives-BDD3; IP-Actives-BDD3 as defined above and that the database BDD1 and / or BDD2 indicates (s) an exit and / or a physical absence of legitimate user of the active IP address (of the listed IP address in the database of IP-Actives-BDD3).

Claims (1)

[Claim 1] Claims Method for defending an understandable / readable, static, frozen in time, and passive network against computer attacks and / or threats, characterized in that it comprises the following steps: - step 1), Virtual transformation of a network - or in other words transformation of the appearance of a network - understandable / readable by virtual inflation or virtual deformation of a network (s). The virtual transformation - transformation of the appearance - of an understandable / readable network can also be carried out by the creation of one or more virtual network (s) by means of one or more computer code (s) (s) to subsequently include one or more real network (s) in one or more virtual network (s) created. - step 2), Virtual transformation, or in other words, transformation of the appearance of a "static" and "frozen in time" network into a "virtually dynamic, variable and random in time" network. The virtual transformation, or in other words, transformation of the appearance of a “static” and “frozen in time” network into a “virtually dynamic and random in time” network is carried out by setting up one or more several changing configuration (s) over time of one or more virtual network (s) icluding one (or more) real network (s). The dynamicity of a network and the transformation of its invariable characteristic into variable and random characteristics therefore take place thanks to the fact that the configurations are changing (s) and / or random (s) over time. - step 3), Transformation of the passive characteristic of a network into a passive / active characteristic "when questioning a network by one or more IT request (s) or when questioning one or more IT equipment (s) ) by requests. The transformation of the passive characteristic during questioning by requests is carried out by the emission, during questioning / requests), of false information and / or false vulnerabilities / flaws. The issue of false information / false vulnerabilities / false flaws during questioning of a computer network by one or more computer request (s) is achieved through the addition to a network of one or more computer codes created for this purpose. [Claim 2] Method according to claim 1 characterized in that in step 1), the virtual transformation and / or the virtual inflation and / or the virtual deformation of a network, that is to say also the virtual transformation and / or the inflation virtual and / or virtual deformation of the infrastructure or infrastructures of a network is (are) achieved "by cloning the IT infrastructure" of a network and / or "by cloning IT equipment of a computer network "such as and this by way of example but not exclusive: terminals, computers, servers, printers, wifi access points, IPs, etc. [Claim 3] Method according to claim 1 characterized in that in step 1), the virtual transformation and / or the virtual inflation and / or the virtual deformation of a network by a cloning of a network and / or by a cloning of the 'infrastructure of a computer network and / or IT equipment' is (are) created by the creation of X clones for a network and / or by the creation of X Clones for each IT equipment or by the creation of X clones for part of the IT equipment. [Claim 4] Method according to claim 1 characterized in that after step 1) of inflation, deformation and amplification and / or creation of one or more virtual network (s) by means of one or more computer code (s) to subsequently include one or more real network (s) in one or more virtual network (s) created, a creation and installation of "Mines" on the clones and / or on the virtual network (s) which includes (s) a real network (s). [Claim 5] Method according to claim 1 characterized in that step 1) further includes a sub-step a1), Step a1) being a generation and maintenance of a virtual activity by adding one or more computer codes created for this purpose, in a network, inflated and deformed by Cloning, or in a network inflated and deformed by through the addition to a network of one or more computer code (s) creating a network (s) and / or virtual computer equipment (s) to include one or more several real networks. Step a1) can also be carried out by a virtual amplification of one (or more) real activity (ies) of a network also called the traffic of a real network and the mantian of this activity amplified by means of the addition to a network of one or more computer code (s) created for this purpose. [Claim 6] Method according to claim 1 characterized in that step 3) further includes a sub-step a3), Step a3) is characterized by “scrambling” and “biasing” the results of questions from a computer network or from the computer equipment of a computer network when one or more requests are sent to this computer network. (s) IT. [Claim 7] A method according to claim 1 characterized in that in step a3), the scrambling and biasing of the results of the interrogations of a computer network by computer requests is (are) carried out "by saturation / by drowning". And this "by a broadcast during questioning and requests for false information" and / or "false vulnerabilities" to bias the results of computer requests that question a computer network. The emission of a large number or preferably a very large number of false information "and / or" false vulnerabilities "makes it possible to" saturate the results and the responses "and thus" drown the real responses and vulnerabilities in a very large quantity false answers and vulnerabilities ”. [Claim 8] A method according to claim 1 characterized in that in step a3), the jamming by saturation / by drowning is carried out by the emission of a large number of false information and vulnerabilities concerning a network and the equipment associated with a network by through the addition to a network of one or more computer code (s) programmed to send a large number of false information and vulnerabilities to each request received by a computer network or by computer equipment on a network computer science. [Claim 9] Method according to Claim 1, characterized in that in step a3), the jamming by saturation / by drowning is also carried out by the random emission at each request of a large number of false information and vulnerabilities concerning a network and equipment associated with a network. And this by adding to the computer code (s), one or more algorithm (s) which randomly modify the false vulnerabilities to be issued. [Claim 10] Method according to claim 1 characterized in that in step a3), the jamming by saturation / by drowning is carried out by the addition of a large number of false vulnerabilities or faults on a virtual network (s) ( s) created by virtual inflation (by Cloning by way of nonexclusive example) or by computer code (s), by the systematic emission in this case of false vulnerabilities by mechanical effect of the addition of false vulnerabilities in the network virtually inflate and / or [Claim 11] [Claim 12] the virtual network (s) created by computer code and which includes (s) the real network (s). In this case, random transmission is also possible through the addition of one or more algorithm (s) that randomly modify the false vulnerabilities added and their locations in a network inflated by cloning or in a virtual network (s) created by computer code (s) and which includes (s) a real network (s). Three computer programs called in this patent application: computer program 1, computer program 2 and computer program 3, comprising code instructions which, when executed on a processor, carry out the steps of Method A according to one or more of claims 1 to 9. Defense method against electronic mail (s) known as singular e-mail - known as trapped by the presence of malicious code (s)) or by the presence of virus / infection (s) / code (s) malicious in an attachment or attachments to its (their) content (s) or in a hyperlink (s) of its (their) content (s) by a new strategy called opening strategy in the middle - on a computer network - separate / isolated or failing that in the middle - on a computer network (s) and / or on computer equipment (s) - non-sensitive (s). The opening of the attachments and the clicking (click action) is therefore also carried out on a computer terminal (s) separate (isolated) or, failing that, not sensitive. An isolated, separate computer network (s) means: one (s) - computer network (s) - separate / isolated from the network (s) (x) IT (s) of the target (targets). An isolated, separate computer network (s) may also be substituted by a computer network (s) and / or a terminal (terminals) ) non-sensitive. A non-sensitive computer network (s) means a network (networks) which, if infected above (inside), do not cause - do not have ( major or significant risk ^ and / or major or significant damage to the target (a target). A non-sensitive computer terminal (s) i.e. a terminal (terminals) which in the event of infection on (inside), does not cause (s) - does not present (s) no - major or significant risk (s) ^ and / or (major or significant damage (s) ^) to the target (a target). This method of defense against electronic mail (s) known as e-mails - e-mail in the singular - said trapped (s) is characterized in that it comprises the following stages: - step 1), identification and / or manual collection (by a human) and / or by (automated) analysis on the basis of predefined rules and equations (predefined computer codes), emails carrying and / or comprising in their content a piece or attachments and / or a hypertext link (s). - step 2), the opening of the attachment (s) and the clicking (action which consists in clicking) on the hypertext link (s) from an environment / medium / network isolated (separate) or failing this from a non-sensitive environment / medium / network. Technically, this results in an opening or at least a first opening of the attachment (s) and the clicking (action which consists of clicking) on the hypertext link (s) on a ( from one or more isolated network (s) / separate from the target computer network (s) or, failing this, from a non-sensitive environment / medium / network. Technically, this results in an opening or at least a first opening of the attachment (s) and the clicking (action which consists of clicking) on the hypertext link (s) on a ( from one) or (from) several terminal (terminals) - computer (s) for example, etc. isolated / separated from the target computer network (s). A terminal (terminals) - computer (s) for example, etc. - isolated / separated from the network (s) (- IT is technically a terminal (terminals) - computer (s) for example - connected (s) / connected (s) / installed (s) at (on) a ( of) separate / isolated network (s). - step 3), the return of the files and / or data recovered from the hypertext link (s) and / or the open attachment (s) - after they have been opened and click on it - on an isolated / separate network (s) towards the initial recipient (s). [Claim 13] A computer program called in this patent application program 4, comprising code instructions which, when executed on a processor, carry out the steps of the Method of claim 12. [Claim 14] Method of defense against computer attacks by detecting illegitimate activity (ies) / presence (s) on a computer network (s) by a comparison of (s) "Data of presence (s) and / or physical absence (s)" of legitimate users to "data of computer activity (s) of legitithne users". [Claim 15] Method according to claim 14 characterized in that the defense against computer attacks by detecting activity (s) - illegitimate presence (s) on a computer network (s) is carried out by a comparison of the presence data (s) / physical absence (s) of a legitimate user of an IP address with activity on a computer network (s) of this same IP address. [Claim 16] A program called in this patent application: program 5, comprising code instructions which, when executed on a processor, carry out the process steps of claims 14 and 15.